I'm trying to enable ufw
in remote ubuntu server. This server has two LXC
container running. One container has nginx server running and I have hosted web application, right now every thing is working fine. I did port forwarding to access webapp of container from local system. I wanted to allow only 80 and 22 to be accessible through firewall, remaining all won't be allowed. These are the rules I did
# ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
22 ALLOW IN Anywhere
80 DENY IN Anywhere
22 (v6) ALLOW IN Anywhere (v6)
80 (v6) DENY IN Anywhere (v6)
after I enable the firewall with port 80 DENY I still be able to access the webapp of the container.
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:http to:10.0.3.2:80
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.0.3.0/24 !10.0.3.0/24
Again to check whether firewall is working or not I tried use scp
, scp
will use port 21. As my firewall in ubuntu server is enable I shouldn't allow to copy file to server but I can able to copy files. check this
# scp /home/Attributes123.csv root@myserver:/home/
root@myserver's password:
Attributes123.csv 100% 0 0.0KB/s 00:00
So my firewall setup is not working. any idea why it is not working? I did reboot after enable firewall but no luck.
80 DENY IN Anywhere
because isDefault: deny (incoming)
Chain INPUT (policy ACCEPT)
must be DROP. Something is wrong.sudo iptables -t nat -L
, then all of the default policies areACCEPT
, whereas if I dosudo iptables -L
, the INPUT chain default isDROP
.